# CVE-2026-73252: Mongoose TLS short-record out-of-bounds read

Source: https://junglewise.ai/threats/cve-2026-73252-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-73252 · Severity: high · CVSS 7.5 · Published 2026-10-14

Mongoose is an embedded web server library used in IoT devices and embedded systems. An unauthenticated attacker on the network can send a specially crafted TLS record that triggers a heap memory read beyond allocated bounds, causing the server to crash and become unavailable. This affects only systems using Mongoose's built-in TLS implementation rather than external TLS libraries.

Technologies: [Cesanta Mongoose](https://junglewise.ai/threats/technologies/cesanta-mongoose). Vendors: [Cesanta](https://junglewise.ai/threats/vendors/cesanta).

## Quick answers

**Is CVE-2026-73252 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73252 being exploited in the wild.

**How severe is CVE-2026-73252?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Cesanta Mongoose before 7.23.

**Is there a fix for CVE-2026-73252?** Yes: fixed in 7.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73252 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73252?** Check whether you run Cesanta Mongoose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.23

## Technical details

A vulnerability in the mg_tls_recv_record() function in src/tls_builtin.c allows TLS 1.3 records with a decrypted size of exactly 16 bytes (the authentication tag length) to pass validation, causing integer underflow in the recv_len calculation that sets it to SIZE_MAX. An unauthenticated network attacker can trigger this before certificate or Finished message validation to read stale heap buffer contents, causing denial of service or potential information disclosure.

## Affected products

- Cesanta Mongoose before 7.23

## Timeline

- 2026-10-14: disclosed

## References

- [https://github.com/cesanta/mongoose/commit/758e301f0c9a9885c1b716195df5fe6d6ac9d53e](https://github.com/cesanta/mongoose/commit/758e301f0c9a9885c1b716195df5fe6d6ac9d53e)
- [https://github.com/cesanta/mongoose/releases/tag/7.23](https://github.com/cesanta/mongoose/releases/tag/7.23)

## Related threats

- [Mongoose heap out-of-bounds read in path validation](https://junglewise.ai/threats/cve-2026-115473-mongoose-is-an-embedded-web-server-and-network-library-prior-to)
- [Mongoose TCP option parser bounds check vulnerability](https://junglewise.ai/threats/cve-2026-73261-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose TLS certificate parser bounds check in DER parsing](https://junglewise.ai/threats/cve-2026-73260-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose IPv6CP length field bounds check buffer overflow](https://junglewise.ai/threats/cve-2026-63626-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Cesanta Mongoose stack-based buffer overflow in MQTT broker](https://junglewise.ai/threats/cve-2026-101003-a-weakness-has-been-identified-in-cesanta-mongoose-up-to-7-21)